Electronic authentication is the process of determining whether a user (or device) is authentic or an imposter. During the authentication process, an authentication server compares current information received from the user with expected information to determine whether the user is authentic, i.e., whether the user is a particular person.
Single factor authentication involves an evaluation of only one authentication factor when determining whether the user is authentic. For example, suppose that a user uses a computer to login to a website as a particular person. The authentication server for the website may receive a username identifying the particular person and a password (the authentication factor). The authentication server then compares the received password to a previously stored password for the particular person to determine whether the user is actually the particular person.
Likewise, two factor authentication involves an evaluation of two factors when determining whether the user is authentic. Again, suppose that a user uses a computer to login to a website as a particular person. For two factor authentication, the authentication server for the website may receive a username identifying the particular person as well as (i) a one-time passcode (OTP) from an authentication token that the user possesses (the first authentication factor), and (ii) an adaptive authentication result which is based on information from the user's computer (the second authentication factor). The authentication server then (i) compares the received OTP to an expected OTP and (ii) evaluates the adaptive authentication result against a predefined threshold to determine whether the user is actually the particular person. Authentication is successful only if evaluation of both authentication factors results in a positive outcome.